Tagged Questions

The “secure remote password protocol” is a modern cryptographic protocol for password authenticated key exchange (PAKE). It provides some desireable properties, like a passive eavesdropper being unable to brute-force the password. It is usually used to derive shared session keys from passwords and ...

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...

I'm one of the developers of an application which uses SRP-6 as the authentication mechanism. The authentication part of the code is very old and uses N with only 256 bits (all arithmetic is done in ...

I have been wracking my brain trying to develop a functioning implementation of SRP-6a in Python to use with a 3rd-party API that claims to use SRP-6a with $N=$ 2048-bit prime and generator of $2$. ...

Is it considered bad practice to use the same N and q parameters for all users in an SRP-6A based authentication system?
I know that q MUST be a Sophie Germain prime and N a safe prime, but can they ...

I'm currently in the planning phase of an authentication and storage-ish service.
The client needs a file ("ENCFILE") which he will work with. This file will be encrypted with AES256, and stored on ...

I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password.
This states that SRP is part of IEC 11770-4, ...

SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations?
I tried to ...

I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys.
On the client I generated a SHA1 ...

In SRP6a, the public key of server is send after receiving the public key of client A. Its that okay that B send along together with s right after client send the username, and then later on client ...

It seems like the pre-master secret generated during the SRP protocol would make a good source to generate a shared private key using a secure hash to compress it down into a 128/256 symmetric key. ...